feat(engine): de-slop commons, harden security, add targeted compose and env bridge

- Purge misplaced RFCs, scratch tokens, and node-proprietary assets
- Decouple remote provisioning to ci/scripts/init-node.py
- Add targeted composition orchestration in actions/compose.py
- Add host-side Xray stale socket cleanup in /dev/shm
- Add actions/env.py for shell exports and .env synchronization
- Harden UFW, backup retention, host tempfiles, and notify dispatcher
- Add pyproject.toml and Makefile with 78 passing unit tests

actions/utils/extract-traefik-certs.py

@@ -25,8 +25,9 @@ def run(ctx, args):
                      "--source", f"/data/{src_file}", "--dest", "/output", "--domain-subdir=true",
                      "--crt-name=fullchain", "--crt-ext=.pem", "--key-name=privkey", "--key-ext=.pem"],
                     check=True)
-        log.info("Setting secure permissions (600) on extracted keys...")
-        ctx.sys.sudo(["find", abs_dest, "-type", "f", "-name", "*.pem", "-exec", "chmod", "600", "{}", "+"])
+        log.info("Setting secure permissions on extracted certs and keys...")
+        ctx.sys.sudo(["find", abs_dest, "-type", "f", "-name", "*key*.pem", "-exec", "chmod", "600", "{}", "+"])
+        ctx.sys.sudo(["find", abs_dest, "-type", "f", "-name", "*chain*.pem", "-exec", "chmod", "644", "{}", "+"])
         ctx.sys.sudo(["chown", "-R", f"{os.getuid()}:{os.getgid()}", abs_dest])
         log.success("Certificates extracted.")
         ctx.notify.success(TITLE, url, f"Certificates extracted for {node}")

actions/utils/generate-happ-subscriptions.py

@@ -1,29 +0,0 @@
-"""Build and run the shared Happ subscription generator."""
-import os
-import shutil
-from engine.descriptor import Meta, Arg
-
-METADATA = Meta(summary="Generate .psub files from a JSON config via the happ generator (docker).",
-                args=[Arg("input_json", "input JSON config"), Arg("output_dir", "output directory")])
-IMAGE = "happ-subscription-generator"
-
-def run(ctx, args):
-    log = ctx.log
-    src_dir = os.path.join(ctx.paths.commons, "assets", "happ-subscription-generator")
-    inp, out = os.path.realpath(args.input_json), os.path.realpath(args.output_dir)
-    # GNU realpath (bash) fails unless all but the last component exist — without this
-    # guard a mistyped path reaches `docker run -v`, which creates it root-owned.
-    for label, p in (("input_json", inp), ("output_dir", out)):
-        parent = os.path.dirname(p)
-        if not os.path.isdir(parent):
-            log.error(f"Cannot resolve {label}: no such directory: {parent}")
-            raise SystemExit(1)
-    if not shutil.which("docker"):
-        log.error("docker is not installed or not in PATH.")
-        raise SystemExit(1)
-    log.info(f"Building {IMAGE}...")
-    ctx.sys.run(["docker", "build", "-t", IMAGE, src_dir], check=True)
-    log.info(f"Running generator: {inp} -> {out}")
-    ctx.sys.run(["docker", "run", "--rm", "-v", f"{inp}:/app/input.json:ro",
-                 "-v", f"{out}:/app/output:rw", IMAGE, "/app/input.json", "/app/output"], check=True)
-    log.success("Subscription generation completed.")

actions/utils/lint-docker-compose.py

@@ -57,7 +57,8 @@ def _validate_anchor_ips(ctx) -> int:
         if not os.path.isfile(f):
             continue
         try:
-            text = open(f).read()
+            with open(f, encoding="utf-8") as fh:
+                text = fh.read()
         except OSError as e:
             ctx.log.error(f"Cannot read {f}: {e}"); rc = 1
             continue